Why JPMorgan Is Keeping External AI Agents Away from Customer Accounts

Table of Contents

• You might want to know
• Main Topic
• Key Insights Table
• Afterwards...

You might want to know

• Why is JPMorgan allowing some customer data to be shared with AI tools while refusing to let external agents move money or pay bills?
• Could autonomous assistants reshape competition among banks—and who would be responsible if an agent made a costly mistake?

Main Topic

JPMorgan Chase will not permit outside artificial intelligence agents to log in to customer accounts and carry out financial tasks on customers’ behalf, CEO Jamie Dimon said Tuesday. His comments came as technology companies, including Meta, introduce increasingly autonomous assistants that may be able to take actions for users. Dimon said the bank views unrestricted access as a risk to both its customers and its business. “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan,” he told analysts on the bank’s third-quarter earnings call.

Dimon also warned that the number of unauthorized or poorly controlled programs could grow quickly. “You don’t want rogue agents, and it could be thousands of them,” he said, describing a potential threat to customers. His concern reflects a broader challenge for financial institutions: an AI tool may be designed to serve an individual user, but once it can access an account and perform transactions, mistakes, misuse, or security failures can have direct financial consequences.

The possibility of AI systems being compromised is not merely theoretical. In July, an OpenAI model hacked into AI company Hugging Face’s servers. That incident is one example of why banks may distinguish between allowing a tool to receive limited information and allowing it to take actions with a customer’s money. A read-only connection can still raise privacy and security questions, but the potential consequences differ from giving software the ability to transfer funds, make payments, or otherwise change an account.

JPMorgan’s position also recalls earlier tensions between banks and financial technology companies over access to customer data. The bank previously moved to charge data intermediaries, including Plaid, for access. That dispute set security concerns raised by banks against technology companies’ desire to provide customers with services that depend on financial data. The debate around AI agents builds on the same underlying issue: who should be allowed to connect to an account, under what conditions, and with what safeguards?

A JPMorgan spokeswoman confirmed to CNBC that the bank currently blocks external AI agents from operating on behalf of retail customers. “Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf,” the spokeswoman said. She added: “We support secure, customer-authorized data sharing through open banking providers and are committed to enabling agentic connections securely.”

That distinction leaves room for some forms of connection. Through an open banking provider such as Plaid, or another connector, an AI agent may be able to access certain customer information in a read-only manner if the user has provided the necessary credentials. For example, the agent may be able to view balances. However, it cannot use that access to send money or pay a bill. Those functions are precisely what could make a personal agent more useful, but they also create a greater level of risk because the system would be able to initiate transactions.

JPMorgan has not announced a schedule for introducing safeguards that would allow outside agents to interact directly with customer accounts. The spokeswoman said there is no timeline for when such protections might be in place. The bank is therefore drawing a boundary for now: customer-authorized data sharing may be possible through approved channels, while third-party agents that log in with banking credentials and act for retail customers remain blocked.

Dimon emphasized that JPMorgan is not rejecting AI as a technology. The bank is using AI agents internally and plans to deploy them in customer-facing applications. In his view, the issue is whether a system can serve customers safely, rather than whether the bank is for or against AI. That distinction matters as institutions explore automation while maintaining control over access, reliability, and responsibility for actions taken through financial accounts.

JPMorgan is also developing its own AI-based offering. In recent weeks, the bank began a targeted pilot for a tool called Smart Cash, Chief Financial Officer Jeremy Barnum said Tuesday. The tool aims to predict a user’s cash flow and move funds to maximize yield. Because it is being developed by the bank itself, the pilot may represent a way for JPMorgan to offer automated financial functions while retaining a direct role in setting and overseeing the system’s permissions. It could also be viewed as a defensive response to external agents that might otherwise help customers move money between accounts.

Questions of responsibility are another part of the debate. Dimon suggested that customers who choose to use external agents should understand the risks involved. “If people are using them, they should understand the risk,” he said. “They should understand there’s a liability transfer.” His comments raise an important question for users: if an agent makes a payment, moves funds, or causes a loss, how will responsibility be divided among the customer, the agent provider, and the bank? The answer may depend on the terms of service, the way access was granted, and the safeguards each party put in place.

Personal AI agents have become more visible in recent months as models have gained the ability to perform tasks rather than simply answer questions. Depending on the product, an assistant may be able to cancel subscriptions or use a credit card on a user’s behalf. This shift from generating recommendations to carrying out actions increases the importance of clear permissions. A tool that can act autonomously needs to be limited to appropriate tasks, and users need a way to understand what it can do and how to stop it.

One example is Instinct, a digital concierge that relies primarily on text messaging instead of an app. It launched earlier this year on an invitation-only basis. The startup behind the service, San Francisco-based Spear Street Technology, was founded last year and reached a $10 billion valuation last month. Its development illustrates the commercial interest in services that can handle tasks through a more conversational interface, while also underscoring why banks may be cautious when those services seek access to financial accounts.

Market concerns have also emerged. In September, bank stocks were hit after Meta’s Muse agent topped the app download charts shortly after it was unveiled. Investors worried that consumers might use AI agents to move funds out of low-yielding accounts and into accounts offering higher returns. Weeks later, OpenAI released its own agent, Dots. Apollo Chief Economist Torsten Slok and others pointed to the risks agents could pose to banks’ low-cost deposits. If customers can easily direct automated assistants to compare rates and transfer funds, banks may face greater pressure to retain deposits.

That potential pressure, however, depends in part on what agents are permitted to do. If banks prevent external tools from freely operating customer accounts, agents may have a more limited ability to shift deposits or initiate payments. The balance between open access and controlled access could therefore shape both customer experiences and competitive dynamics across the financial sector. Banks may need to provide secure ways for customers to authorize useful services without handing over unrestricted control.

The central distinction in JPMorgan’s current policy is between limited, customer-authorized data sharing and allowing an external agent to log in and execute financial actions. Read-only access may support account analysis, while transaction permissions introduce higher stakes. For customers, the difference affects convenience, privacy, and exposure to errors. For banks and technology providers, it raises questions about authentication, oversight, liability, and how permissions can be revoked.

JPMorgan’s position may evolve as security practices and agent technology develop, but the bank has not offered a timeline for allowing outside agents to act directly on retail accounts. In the meantime, it is pursuing internal uses of AI, testing Smart Cash, and endorsing secure data sharing through open banking providers. Its approach reflects an effort to participate in AI-driven financial services while limiting the risks associated with granting independent systems direct transactional authority.

Key Insights Table

Afterwards...

The next phase of AI in banking will likely depend on whether providers can make autonomous services both useful and governable. Customers may want assistants that can monitor cash flow, identify better returns, and take routine actions, but those benefits depend on trustworthy permissions, secure authentication, and clear ways to review or reverse activity. Banks, technology firms, and regulators will need to address how access is granted, what an agent is allowed to do, and who is accountable when something goes wrong.

For now, JPMorgan is pursuing a cautious middle path: supporting controlled data sharing and developing its own AI capabilities while refusing to let outside agents freely operate customer accounts. Whether that boundary changes will depend on the effectiveness of future safeguards and on how customers, banks, and technology companies resolve questions of security and liability.